a:© 




E2 W 




FIG. 3 



t 



' o 



MONITOR NETWORK PACKETS 
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BUILD STATISTICAL PROFILES 
FROM MEASURES DERIVED FROM 
NETWORK PACKETS 
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DETERMINE IF STATISTICAL 
PROFILE IS ANOMALOUS 
(ABNORMAL) 
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RESPOND 
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FIG. 4 



RECEIVE EVENT RECORD 
(e.g. DESCRIBING A PACKET) 
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DESTRIBUTE FOR ADDITION TO ONE OF 
A MULTIPLE OF SHORT-TERM STATISTICAL PROFILES 
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COMPARE ONE OF THE SHORT-TERM PROFILES 
TO A CORRESPONDING LONG-TERM 
STATISTICAL PROFILE 
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FIG. 5 
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FIG. 6 
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